A malformed secret reference warns the author

Writing {{ secrets.NAME }} instead of ${{ secrets.NAME }} produces a literal string at execution rather than a secret, silently and with no error. The warning exists to catch the missing $ while the author is still looking.

The rule

Normative: this is the rule

A string in a node's config that contains {{ secrets. without the leading $ yields a warning at node.{id}.config.{key} telling the author to write ${{ secrets.NAME }}.
Config is walked recursively, so a reference nested inside structured config is covered.
A correctly written ${{ secrets.NAME }} produces no warning, and the save is never blocked either way.

What it means

The check exists because a missing $ fails silently at run time rather than at save time: {{ secrets.NAME }} without the leading $ is not a secret reference at all, so nothing about it stops the save or fails the run — it simply never resolves to the secret the author meant. The warning is the only point where the missing character is still visible. It reaches a reference no matter how deep it sits inside a key's value, so a reference nested a level down still draws the warning.

Example

A header value nested inside a node's configwarns

{"headers": {"Authorization": "Bearer {{ secrets.stripe }}"}}

The same header written with the leading $accepted

{"headers": {"Authorization": "Bearer ${{ secrets.stripe }}"}}

Rule identifiers are permanent and are never renumbered. Each implementation publishes its own standing against these rules; this specification does not.spec 1.0-draft · R6.l · changed in spec 1.0